Real-time user traffic classification in wireless networks

ABSTRACT

A device can receive, from a network node device, call trace event data relating to characteristics of a wireless communication session between the network node device and a user equipment. The device can sequence and combine the call trace event data for a period of the wireless communication session. The device can analyze the call trace event data to determine a category of network communication traffic transmitted via a communication channel between the network node device and the user equipment. In response to a determination that the network communication traffic comprises streaming video packets, the device can facilitate directing of network resources to be allocated to support the wireless communication session.

RELATED APPLICATION

The subject patent application is a continuation of, and claims priorityto, U.S. patent application Ser. No. 16/210,453 (now U.S. Pat. No.10,772,016), filed Dec. 5, 2018, and entitled “REAL-TIME USER TRAFFICCLASSIFICATION IN WIRELESS NETWORKS,” the entirety of which applicationis hereby incorporated by reference herein.

TECHNICAL FIELD

The present application relates generally to the field of wirelesscommunication, e.g., to the classification of network communicationtraffic in wireless networks.

BACKGROUND

Radio technologies in cellular communications have grown rapidly andevolved since the launch of analog cellular systems in the 1980s,starting from the First Generation (1G) in the 1980s, Second Generation(2G) in the 1990s, Third Generation (3G) in the 2000s, and FourthGeneration (4G) in the 2010s (including Long Term Evolution (LTE) andvariants of LTE). Fifth generation (5G) access networks, which can alsobe referred to as New Radio (NR) access networks, are currently beingdeveloped and expected to fulfill the demand for exponentiallyincreasing data traffic, and to handle a very wide range of use casesand requirements, including services such as enhanced mobile broadband(eMBB) services, massive machine type communications (mMTC), andultra-reliable and low-latency communications (uRLLC).

Traffic has been growing steadily in wireless networks in the pastyears, and emerging applications such as video streaming keeps themomentum going. It is predicted that video will account for 70% of allmobile traffic within a few years. Video streaming traffic, inparticular, is different from other types of traffic. The resourcesrequired to maintain an acceptable user experience for video streamingare different than that required for other types of traffic, such asvoice over Internet Protocol (VoIP), video downloading, messaging,gaming, and p2p, etc. A small quantity of video sessions (<10%)contribute 50% or more of the total traffic.

The above-described background relating to wireless networks is merelyintended to provide a contextual overview of some current issues and isnot intended to be exhaustive. Other contextual information may becomefurther apparent upon review of the following detailed description.

BRIEF DESCRIPTION OF THE DRAWINGS

Non-limiting and non-exhaustive embodiments of the subject disclosureare described with reference to the following figures, wherein likereference numerals refer to like parts throughout the various viewsunless otherwise specified.

FIG. 1 illustrates an example wireless communication system having anetwork node device (also referred to herein as a network node) and userequipment (UE), in accordance with various aspects and exampleembodiments of the subject disclosure.

FIG. 2 illustrates an example centralized core network (CN) incomparison with a distributed CN implementing control plane and userplane separation, in accordance with various aspects and exampleembodiments of the subject disclosure.

FIG. 3 illustrates the bandwidth and latency requirements for differentcommunication services, in accordance with various aspects and exampleembodiments of the subject disclosure.

FIG. 4 illustrates an example of network slices, each havingcombinations of network functions, in accordance with various aspectsand example embodiments of the subject disclosure.

FIG. 5 illustrates an example system in which a traffic categorizer andfacilitator (TCF) device can operate, in accordance with various aspectsand example embodiments of the subject disclosure.

FIG. 6 illustrates a chart showing examples of call trace (CT) eventdata, in accordance with various aspects and example embodiments of thesubject disclosure.

FIG. 7 illustrates an example of CT events sequenced and combined, fortraffic related to three example UEs, in accordance with various aspectsand example embodiments of the subject disclosure.

FIG. 8 illustrates an example of an early stage window in which trafficcategorization can take place, in accordance with various aspects andexample embodiments of the subject disclosure.

FIGS. 9-12 illustrate example operations that can be performed by a TCF,in accordance with various aspects and example embodiments of thesubject disclosure.

FIG. 13 illustrates an example block diagram of a computer that can beoperable to execute processes and methods, in accordance with variousaspects and embodiments of the subject disclosure.

DETAILED DESCRIPTION

The subject disclosure is now described with reference to the drawings,wherein like reference numerals are used to refer to like elementsthroughout. The following description and the annexed drawings set forthexample aspects of the subject matter. However, these aspects areillustrative of but a few of the various ways in which the principles ofthe subject matter can be employed. Other aspects, advantages, and novelfeatures of the disclosed subject matter will become apparent from thefollowing detailed description when considered in conjunction with theprovided drawings. In the following description, for purposes ofexplanation, numerous specific details are set forth in order to providea more thorough understanding of the subject disclosure. It may beevident, however, that the subject disclosure can be practiced withoutthese specific details. In other instances, structures and devices areshown in block diagram form to facilitate describing the subjectdisclosure.

The methods and operations (e.g., processes and logic flows) describedin this specification can be performed by devices (e.g., networkmanagement device, gateway device, computer, computing device, etc.)comprising programmable processors that execute machine executableinstructions (e.g., computer program product, computer-readableinstructions, software, software programs, software applications,software modules, etc.) to facilitate performance of the operationsdescribed herein. Examples of such devices can be devices comprisingcircuitry and components as described in FIG. 13.

In the upcoming 5G and other next-gen networks, network services areslated to be handled by decentralized virtual network functions (VNFs)that are instantiated either for a specific service, or group ofservices. However, there are conditions or events that arise that canrequire additional resources that exceed the capabilities that can beprovided by a particular network slice. The present patent applicationrelates to the provision of network resources, in response to adetermination that the network communication traffic comprises streamingvideo packets. The network resources be allocated to support thecommunication sessions comprising streaming video traffic using, forexample, VNFs and software-defined networking methods.

FIG. 1 illustrates an example wireless communication system 100 (alsoreferred to as wireless system 100, mobile system 100, mobilecommunications system 100) in accordance with various aspects andembodiments of the subject disclosure. In example embodiments (alsoreferred to as non-limiting embodiments), wireless communications system100 can comprise a mobile (also referred to as cellular) network 106,which can comprise one or more mobile networks typically operated bycommunication service providers. The wireless communication system 100can also comprise one or more user equipment (UE) 102 _(1-N) (alsoreferred to as UE 102). UE 102 _(1-N) can communicate with one anothervia one or more network node devices (also referred to as network nodes)104 _(1-N) (referred to as network node 104) of the mobile network 106.The dashed arrow lines from the network nodes 104 _(1-N) to the UE 102_(1-N) represent downlink (DL) communications and the solid arrow linesfrom the UE 102 _(1-N) to the network nodes 104 _(1-N) represent uplink(UL) communications.

UE 102 can comprise, for example, any type of device that cancommunicate with mobile network 106, as well as other networks (seebelow). The UE 102 can have one or more antenna panels having verticaland horizontal elements. Examples of a UE 102 comprise a target device,device to device (D2D) UE, machine type UE, or UE capable of machine tomachine (M2M) communications, personal digital assistant (PDA), tablet,mobile terminal, smart phone, laptop mounted equipment (LME), universalserial bus (USB) dongles enabled for mobile communications, a computerhaving mobile capabilities, a mobile device such as cellular phone, adual mode mobile handset, a laptop having laptop embedded equipment(LEE, such as a mobile broadband adapter), a tablet computer having amobile broadband adapter, a wearable device, a virtual reality (VR)device, a heads-up display (HUD) device, a smart car, a machine-typecommunication (MTC) device, and the like. UE 102 can also comprise IOTdevices that communicate wirelessly.

Mobile network 106 can include various types of disparate networksimplementing various transmission protocols, including but not limitedto cellular networks, femto networks, picocell networks, microcellnetworks, internet protocol (IP) networks, Wi-Fi networks associatedwith the mobile network (e.g., a Wi-Fi “hotspot” implemented by a mobilehandset), and the like. For example, in at least one implementation,wireless communications system 100 can be or can include a large scalewireless communication network that spans various geographic areas, andcan comprise various additional devices and components (e.g., additionalnetwork devices, additional UEs, network server devices, etc.).

Still referring to FIG. 1, mobile network 106 can employ variouscellular systems, technologies, and modulation schemes to facilitatewireless radio communications between devices (e.g., the UE 102 and thenetwork node 104). While example embodiments might be described for 5GNew Radio (NR) systems, the embodiments can be applicable to any radioaccess technology (RAT) or multi-RAT system where the UE operates usingmultiple carriers. For example, wireless communications system 100 canbe of any variety, and operate in accordance with standards, protocols(also referred to as schemes), and network architectures, including butnot limited to: global system for mobile communications (GSM), 3 GSM,GSM Enhanced Data Rates for Global Evolution (GSM EDGE) radio accessnetwork (GERAN), Universal Mobile Telecommunications Service (UMTS),General Packet Radio Service (GPRS), Evolution-Data Optimized (EV-DO),Digital Enhanced Cordless Telecommunications (DECT), Digital AMPS(IS-136/TDMA), Integrated Digital Enhanced Network (iDEN), Long TermEvolution (LTE), LTE Frequency Division Duplexing (LTE FDD), LTE timedivision duplexing (LTE TDD), Time Division LTE (TD-LTE), LTE Advanced(LTE-A), Time Division LTE Advanced (TD-LTE-A), Advanced eXtended GlobalPlatform (AXGP), High Speed Packet Access (HSPA), Code Division MultipleAccess (CDMA), Wideband CDMA (WCMDA), CDMA2000, Time Division MultipleAccess (TDMA), Frequency Division Multiple Access (PUMA), Multi-carrierCode Division Multiple Access (MC-CDMA), Single-carrier Code DivisionMultiple Access (SC-CDMA), Single-carrier FDMA (SC-FDMA), OrthogonalFrequency Division Multiplexing (OFDM), Discrete Fourier TransformSpread OFDM (DFT-spread OFDM), Single Carrier FDMA (SC-FDMA), FilterBank Based Multi-carrier (FBMC), zero tail DFT-spread-OFDM (ZTDFT-s-OFDM), Unique Word OFDM (UW-OFDM), Unique Word DFT-spread OFDM (UWDFT-Spread-OFDM), Cyclic Prefix OFDM (CP-OFDM), resource-block-filteredOFDM, Generalized Frequency Division Multiplexing (GFDM), Fixed-mobileConvergence (FMC), Universal Fixed-mobile Convergence (UFMC), MultiRadio Bearers (RAB), Wi-Fi, Worldwide Interoperability for MicrowaveAccess (WiMax), and the like.

Still referring to FIG. 1, in example embodiments, UE 102 can becommunicatively coupled (or in other words, connected) to a network node104 of the mobile network 106. Network node 104 can have a cabinet andother protected enclosures, an antenna mast, and multiple antennas forperforming various transmission operations (e.g., multiple inputmultiple output (MIMO) operations). Each network node 104 can serveseveral cells, also called sectors, depending on the configuration andtype of antenna. Network node 104 can comprise NodeB devices, basestation (BS) devices, mobile stations, access point (AP) devices, andradio access network (RAN) devices. Network node 104 can also includemulti-standard radio (MSR) radio node devices, including but not limitedto: an MSR BS, an eNode B device (e.g., evolved NodeB), a networkcontroller, a radio network controller (RNC), a base station controller(BSC), a relay device, a base transceiver station (BTS), an accesspoint, a transmission point (TP), a transmission/receive point (TRP), atransmission node, a remote radio unit (RRU), a remote radio head (RRH),nodes in distributed antenna system (DAS), and the like. In 5Gterminology, the network node is referred to by some as a gNodeB (gNB)device, which provides NR user plane and control plane protocolterminations towards the UE, and connects to the 5G core.

Still referring to FIG. 1, in various embodiments, mobile network 106can be configured to provide and employ 5G cellular networking featuresand functionalities. 5G wireless communication networks are expected tofulfill the demand of exponentially increasing data traffic and to allowpeople and machines to enjoy gigabit data rates with virtually zerolatency. Compared to 4G, 5G supports more diverse traffic scenarios. Forexample, in addition to the various types of data communication betweenconventional UEs (e.g., phones, smartphones, tablets, PCs, televisions,Internet enabled televisions, etc.) supported by 4G networks, 5Gnetworks can be employed to support data communication between smartcars in association with driverless car environments, as well as machinetype communications (MTCs). Considering the different communicationneeds of these different traffic scenarios, the ability to dynamicallyconfigure waveform parameters based on traffic scenarios while retainingthe benefits of multi carrier modulation schemes (e.g., OFDM and relatedschemes) can provide a significant contribution to the highspeed/capacity and low latency demands of 5G networks. With waveformsthat split the bandwidth into several sub-bands, different types ofservices can be accommodated in different sub-bands with the mostsuitable waveform and numerology, leading to an improved spectrumutilization for 5G networks.

Still referring to FIG. 1, to meet the demand for data centricapplications, features of proposed 5G networks may comprise: increasedpeak bit rate (e.g., 20 Gbps), larger data volume per unit area (e.g.,high system spectral efficiency—for example about 3.5 times that ofspectral efficiency of long term evolution (LTE) systems), high capacitythat allows more device connectivity both concurrently andinstantaneously, lower battery/power consumption (which reduces energyand consumption costs), better connectivity regardless of the geographicregion in which a user is located, a larger numbers of devices, lowerinfrastructural development costs, and higher reliability of thecommunications. Thus, 5G networks may allow for: data rates of severaltens of megabits per second should be supported for tens of thousands ofusers, 1 Gbps to be offered simultaneously to tens of workers on thesame office floor, for example; several hundreds of thousands ofsimultaneous connections to be supported for massive sensor deployments;improved coverage, enhanced signaling efficiency; reduced latencycompared to LTE.

The upcoming 5G access network may utilize higher frequencies (e.g., 6GHz) to aid in increasing capacity. Currently, much of the millimeterwave (mmWave) spectrum, the band of spectrum between 30 gigahertz (Ghz)and 300 Ghz is underutilized. The millimeter waves have shorterwavelengths that range from 10 millimeters to 1 millimeter, and thesemmWave signals experience severe path loss, penetration loss, andfading. However, the shorter wavelength at mmWave frequencies alsoallows more antennas to be packed in the same physical dimension, whichallows for large-scale spatial multiplexing and highly directionalbeamforming.

Referring now to FIG. 2, the upcoming 5G access network can also employan architecture in which a user plane and control plane are separate,wherein complex control plane functions are abstracted from forwardingelements, simplifying user plane operations by relocating control logicto physical or virtual servers. Each plane carries a different type oftraffic and can be implemented as overlay networks that runsindependently on top of one another, although supported by itsinfrastructure. The user plane (sometimes known as the data plane,forwarding plane, carrier plane, or bearer plane) carries the networkuser traffic, and the control plane carries signaling traffic. Typicalcontrol-plane functionality includes capabilities such as themaintenance of location information, policy negotiation and sessionauthentication. In example embodiments, the planes can be implemented inthe firmware of routers and switches. As shown in FIG. 2, a mobilenetwork (e.g., mobile network 106) with a centralized core network (CN)can be decentralized, resulting in a distributed CN, which acts as acontroller in a mobile communication network, and performs underlyingtasks required for providing mobile communication services (e.g., userauthentication, data transmission, etc.). To abstract the networkresources from the underlying physical hardware, the control plane anduser plane are separated, abstracting the network resources from theunderlying physical hardware. This separation allows user-planefunctionality to move to the network edge, and management functionalityto remain at the core. For example, as shown in FIG. 2, the servinggateway (S-GW) 205 in a centralized CN can, in a distributed CN, beseparated into a S-GW-C 210 for the control plane and S-GW-U 215 for theuser plane, wherein the user plane functionality is closer to thenetwork edge. Likewise, as shown in FIG. 2, the Packet Data Network(PDN) gateway (P-GW) 220 can be separated into P-GW-C 225 for thecontrol plane, and the P-GW-U 230 for the user plane, with the S-GW-U215 and P-GW-U 230 functionality being moved closer to the edge of thenetwork. In this distributed CN, the physical core can be virtuallyseparated and relocated in the network into multiple virtual corenetworks using virtualization technology. This software-definednetworking (SDN) approach, can be complimentary to a network functionsvirtualization (NFV) approach, in which a virtual network function (VNF)is responsible for handling specific network functions (NFs) that run onone or more virtual machines (VMs) on top of the hardware networkinginfrastructure (e.g., routers, switches, etc.). Individual VNFs can beconnected or combined to offer a particular network communicationservice. Both SDN and VNF can facilitate the implementation of networkslicing (described further below).

In 5G and other next generation networks, network services can behandled by decentralized virtual network functions, called networkslices, that are instantiated either for a specific, dedicated service,or group of services, utilized by subscribers or large enterprises.These slices can be made to perform specific tasks depending on thelocation, quality of service (QoS) and capacity of a given service.Thus, instead of having one network that serves all devices on thenetwork and performs all services, a single physical network can besliced into multiple virtual networks that can draw from both CN andradio access network (RAN) resources to provide a specific service. Inthis manner, network slices can be specifically configured to support amultitude of use cases and new services. Each use case involvesperformance requirements that vary enormously. As shown in FIG. 3, thebandwidth and latency related to each service can vary. IOT sensors andmeters 305 might require service that is low bandwidth and mediumlatency. Smartphones 310 might require high bandwidth and mediumlatency. Autonomous vehicle services 315 rely on V2X(vehicle-to-anything) communications which requires low latency but notnecessarily a high bandwidth. Live video streaming 320 that supportsvideo games with video streaming and live sporting events might requirea very high bandwidth, but low latency. As such, different use casesplace different requirements on the network in terms of functionality.Each specific service requires different resources, receiving a specificset of optimized resources and network topology that covers certainservice level agreement specified factors for delivering the service,including such factors as such as connectivity, speed, and capacity. Forexample, for autonomous vehicle services 315, Ford, Lyft, or Chevy mighteach have a different service level agreement with a network provider tosupport their autonomous vehicle communication services.

Referring now to FIG. 4, a service orchestration manager 405 caninstantiate network slices 410 _(1-N) of the network comprisingcombinations of VNFs (virtual network functions (NFs)) on defaulthardware (HW) in order to reduce the network complexity, and providecapital savings on proprietary HW and software. Each network slice canbe instantiated, depending on, for example, the location (such asdedicated slice close to a large customer enterprise) or quality ofservice (e.g., high QoS slice for a premium service). These slices canbe part of a cloud network running on a default hardware with givenlimitations such as number of dedicated processors and memory, etc. Asshown in FIG. 4, with network slicing, each of these services can bedelivered over the same common physical network on multiple virtualnetwork slices to optimize use of the physical network. A slice #1 410 ₁can be instantiated to support IOT meters and sensors 305. A slice #2410 ₂ can serve smartphones. A slice #3 410 ₃ can serve autonomousvehicle services 315. A slice #4 410 ₄ can support live video streaming320. N number of slices in the network (e.g., slice #N 410 _(N)) can beinstantiated to support other services. Each network slice can comprisean independent set of logical, network functions NFs 415 _(1-N) (alsoreferred to herein as tasks) that support the requirements of particularservices (e.g., the term “logical” can refer to software), with some NFsthat can be shared across multiple slices (e.g., NF1 415 ₁ is commonacross the slices), while other NFs are tailored to a particular networkslice. An NF can comprise network nodes functionality (e.g. sessionmanagement, mobility management, switching, routing functions) which hasdefined functional behavior and interfaces. Thus, NFs can be implementedas a network node (e.g., network node 104) on a dedicated hardware or asvirtualized software functions. The service orchestration manager 405can perform selection functions, for example using SDN, that pair theresources and network topology (e.g., RAN and fixed access, terminal,transport, and CN resources) needed for the specific service and trafficthat uses the slice. In this way, functions such as speed, capacity,connectivity and coverage can be allocated to meet the specific demandsof each use case. Not only can a network slice be specificallyinstantiated for certain services, it can be reused.

Due to the privacy and protocol regulations, most applications in thewireless networks are encrypted so that it is difficult to identifyuser's traffic category, including in real time (e.g., live videostreaming) Since most application information are encrypted, thewireless operators only know the traffic types of small amount. Forexample, video optimization algorithms could only be applied to limitednumber of applications which are revealed to the operators. There hasbeen little research related to identifying the application/service typefrom radio access networks (RAN), or even the core networks. Based onmobile user's reports, a small proportion of users voluntarily reporttheir application types, but the data is only available offline.

Current network prioritization is based on QCI classes instead ofservice types. QoS Class Identifier (QCI) is a mechanism used in 3GPPLong Term Evolution (LTE) networks to ensure bearer traffic is allocatedappropriate Quality of Service (QoS). Different bearer traffic requiresdifferent QoS and therefore different QCI values. However, radio accessnetwork (RAN) algorithms do not prioritize a certain video service(e.g., real-time video streaming) over another non-streaming videoservice (e.g., background file download) based on their different QoSrequirements, such as throughput and latency.

There is also no ability for current networks to perform real-timeclassification of traffic to determine whether the traffic is videostreaming traffic, which consumes a lot of bandwidth/resource with highvolumes and long durations. In the present art, traffic reports can beused to categorize user traffic according to the overall duration andtraffic volume. However, this is conducted after the session ends andcannot help real-time user traffic control. A real-time determinationcan enable more performance optimization in the subsequent period beforethe video session ends.

FIG. 5 depicts an example systems and methods (e.g., traffic categorizerand facilitator 505 (TCF 505) performing operations as described herein)that can allow for traffic of different types to be categorized suchthat the traffic can be addressed in the software defined network (SDN)and network slicing framework differently, in accordance with exampleembodiments of the present application. The TCF 505, can comprise one ofmore computing devices, e.g., located within mobile network 106.

The TCF 505 can also be operable to categorize traffic in real-time,enabling more resources to be made available through SDN and networkslicing, before a video streaming session has concluded. As such, theTCF 505 of the present application can facilitate large-scale usertraffic classification for UE level real-time network control andtraffic prediction (e.g., real-time traffic classification to identifyvideo-streaming like transmissions between the network node and UEs(long duration and large traffic) among general traffic (variousdurations and low traffic) in the early stage of new radio resourcecontrol (RRC) sessions (like 10 seconds, 20 seconds, 30 seconds, 120seconds, etc.).

Still referring to FIG. 5, in example embodiments in accordance with thepresent application, the TCF 505 can serve as a framework for real-timeuser traffic classification in a mobile network. The TCF 505 is operableto receive real-time streaming network data, in that the streamingnetwork data is being received while a video streaming sessionexperienced by a UE (e.g., UE 102 _(1-N)), served by network nodes(e.g., network nodes 104 _(1-N)). In example embodiments, the real-timestreaming network data can comprise streaming call trace (CT) eventsdata, reported to the TCF 505 by network nodes in real-time for each UEserviced by each network node. Different types of CT events (see, e.g.,FIG. 6 below), can be combined into a sequence of traffic reportsordered by time (see, e.g., FIG. 7 below). The TCF 505 can implement amachine-learning model that predicts user's traffic category based onthese generated CT event sequences during the early stage of UE softwareapplication sessions.

In example embodiments, labels (e.g., labeling a session asstreaming-video, downloaded video, etc.) used in conjunction withtraining and validation data are derived based on either knownapplication information or traffic report characteristics. An offlinetraining model can be used to acquire historical CT events of existingsessions with known application category and form a time sequence of CTevents. The time sequence of CT events can be formulated as a sequenceclassification task, wherein CT event sequences are taken during theearly stage of an application session as input, and the traffic categoryof that session is used as the output. Various machine-learningclassification models (e.g., algorithms) including but not limited togradient boosting machine, random forecast classification, and LongShort-Term Memory (LS™) neural network, can be used to “train” the TCF505.

An optimal model (e.g., model for categorizing traffic) can beformulated by the TCF 505 based on the performance metrics (accuracy,precision, and recall, etc.) in the validation processes. Thewell-trained model can then be applied to real-time streaming data(e.g., CT events data) to recognize UE traffic categories. Thus, inpractice mode (e.g., not offline-training), the well-trainedclassification model can be applied by the TCF 505 to all mobile user'sUEs in real time based on the reported TCF event sequences during theearly stages of application sessions/connections (e.g., within secondsof the active application session). Again, the categorization during theearly stages of the application sessions allow for a real-timecategorization of the traffic, as opposed to obtaining reports after theapplication sessions have ended. Categorization during the early stagesallows for additional resources, for example, to allocated to service anapplication streaming video data, so that the user experience does notsuffer (e.g., delays due to jitters, buffering, etc. causing adisjointed video-viewing experience) when a user views a video-streamingapplication on his or her UE. For example, referring to FIG. 5, aftercategorization of traffic being received by a UE (e.g., UE 102 ₁), theTCF 505 can facilitate the allocation of resources for video-streamingapplications of a UE by sending a signal to, for example, anorchestration manager (e.g., service orchestration manager 405), whichas mentioned above, can orchestrate, via SDN, network resources (e.g.,network resources 510) to be allocated for video-streaming applicationsto better optimize the bandwidth allocated for the identifiedvideo-streaming application session run by the UE. Thus, this real-timetraffic categorization can facilitate user-centric optimization so thatthe user experience for video-streaming application sessions can beenhanced.

Additionally, the TCF 505 can conduct the prediction for eachuser/session continuously to improve the classification confidence overtime.

FIG. 6 illustrates a chart 600 showing examples of call trace event data(CT event data), wherein the “X” in each grid represents some indicatoror value (e.g., time, gigabytes, etc.). The TCF 505 can utilize existingreported call trace event records from network nodes without introducingadditional burden on the network traffic flow. As examples, a CT eventdata can be an initial context setup message—when a UE goes from idle toactive, this message is sent by, for example, the mobility managemententity (MME), to request the setup of a UE bearer channel, and then theUE can upload or download on the bearer channel that is set up by thenetwork node for the UE. A CT event can be a context release, which canbe sent when a call is ended, and the UE no longer needs the bearerchannel, or when there is a handover (e.g., when connecting from cellone to cell two). An event might have time stamps associated with it,traffic downlink/uplink (DL) volume, UL/DL duration, and QCI. Forexample, CT event data can comprise a radio bearer traffic report, whichprovides the download and upload volume of a UE within a past period(e.g., video streaming traffic would tend to be indicated by highervolume), downlink and uplink durations (e.g., video streaming trafficwould tend to be indicated by longer downlink and uplink durations), andthe QCI of the traffic type that was downloaded (e.g., for example a QCIcan indicate that the session involves a voice call).

A CT event can include, in general, periodically reported call tracerecords (e.g., periodically reported measurements). Specifically, forexample, a radio UE timing advance (TA) measurement can be used, since aUE's TA measurements are reported periodically (e.g., every minute).Additionally, periodic RF measurements (e.g., reference signal receivedpower (RSRP) and reference signal received quality (RSRQ) measurements)can also be used as a periodic call trace record.

CT event data can also comprise handover events (e.g., when a wirelesscommunication session is handed off from one mobile communication cellto another).

CT event data can also comprise time stamps that are constantly made andreported while the UE application session is still active.

The reporting of these CT events and their associated data elements(e.g., time stamp, etc.) by a network node can be used by the TCF 505 todetermine a sequence of CT events, as shown by FIG. 7 below, whereinmultiple call trace event records can be combined to form a timesequence of user application activities for classification. While no oneevent might be dispositive as to identifying whether traffic is livevideo streaming traffic, collectively the sequenced CT events canprovide a better guess (e.g., higher probability) as to whether trafficcomprises live video-streaming traffic.

As shown in the example illustrated by FIG. 7, for each UE, the TCF 505can identify the active period (shown in dash-lined boxes in FIG. 7)starting with context setup and ending with last context release, beforenext context setup. Handover events with timestamp are also includedwithin the active periods. TA measurements, radio bear traffic reportsare also identified within the same active period based on theirreported serving cell ID and s1apID, since their reported timestamps maybe later than the next context setup due to network settings. CT eventsare ordered within the same active period by their timestamps.

Still referring to FIG. 7, the TCF 505 can use machine learning tools toperform traffic classification in an automated fashion and moreefficiently. As an example, a combination of CT events can be used bythe TCF 505 to better determine a conclusion as to what the category ofthe traffic is (e.g., make a prediction). For example, for a User I withshort duration session 705, if there is a short duration between acontext setup to a context release, it can mean that the communicationsession has ended. For a User II with handovers session 710, if a UE isstill communicating, there can be a call event trace that is a handover(HO) event, followed by a release. Right after the handover, there canbe a radio bearer traffic report, as well as a UE TA measurement. Thesecan all be indications that there is a continuing handover of thesession from cell to cell. If, in addition to the other CT events data,the bearer report has a QCI value that indicates that this is not avoice call, it can be determined, or predicted, that this is more likelyto be a video-streaming session. For User III with long duration session715, after setup, there are multiple UE TA measurements but no contextreleases, which can indicate, along with QCI indication that it is not avoice call, that this might be a user that is using a cellphoneapplication that comprises video-streaming. Thus, a combination of CTevents, and when they occurred, can be used by the TCF to determine, orpredict, whether an active communication session between a UE andnetwork node comprises live video-streaming (e.g., that the packets thatare being passed on the radio bearer channel are packets related tovideo-streaming).

Additionally, as indicated by vertical dashed line 805 in FIG. 8, theTCF 505 can determine a traffic classification before the wirelesscommunication session is over. Instead of waiting until the end of theUE activity, the TCF 505 categorizes traffic type within the t secondsof context setup (the early stage). This allows for time for resourcesto be allocated to a session identified as involving video-streaming,which can result in a better user experience when a user uses avideo-streaming application.

FIG. 9 illustrates an example process by which UE traffic can becategorized in real-time by a TCF 505.

At data acquisition stage 905, the TCF 505 can be operable to receive,or collect, user UE reported historical records. The historical recordscan relate a UEs reports and messages related to its applicationsessions, including such information as CT events associated with anapplication session, examples of which CT events are shown and describedabove with respect to FIG. 7. The TCF 505 can then perform userapplication category acquisition, in which it acquires, based on the CTevents, the capability to discern between traffic of one category versusanother.

In the traffic category modelling stage 910, key performance indicators(KPIs) are generated, and TCF 505 undergoes machine classifier trainingand evaluation, in which CT events are input into the system for it to“train” itself to evaluate whether, based on a combination of CT events,traffic comprises live video-streaming packets. After training andevaluation based on multiple sets of CT event data, the TCF 505 developsa model by which it can determine and categorize traffic based on, forexample, less than a few minutes of provided CT event data related to aUE.

At the application stage 915, the TCF 505 can apply its model toreal-world UE traffic. The TCF 505 can, for example, receive, via anetwork node device (e.g., network node 104) coupled with a UE (e.g., UE102), CT events data (e.g., real-time user reports, time stamps, bearertraffic reports, context setup and release messages, HO events, etc.)streamed to it. After combining the CT events data, the TCF 505 can beoperable to continuously classify traffic from UEs, and depending on thedetermination of whether that a UE's traffic relates to live streamingvideo, facilitate the selection/optimization of resources for that UE.

FIGS. 10-12 illustrate flow diagrams of example operations that can beperformed, for example, by a TCF (e.g., TCF 505), in accordance withexample embodiments of the subject patent application. In exampleembodiments, the TCF can comprise a device comprising a processor and amemory that stores executable instructions that, when executed by theprocessor, facilitate performance of operations as described in thisapplication. The instructions can be stored on, for example, amachine-readable storage medium (e.g., the memory). Aspects as describedin each flow diagram, or block within a flow diagram, can beinterchanged, or used, in each other flow diagram, or can be combined tocomprise an operation not described in the flow diagrams.

Referring now to FIG. 10, example operations 1000, which can beperformed by TCF 505, can comprise, at step 1010, receiving, from anetwork node device (e.g., network node device 104) of a wirelessnetwork (e.g., wireless communications system 100), call trace eventdata relating to a characteristic of a wireless communication sessionbetween the network node device and a user equipment (e.g., UE 102). Thecall trace event data (e.g., see FIG. 6) can comprise initial contextsetup data related to establishing the communication channel. The calltrace event data can comprise context release data, wherein the contextrelease data relates to a release of the communication channel forfuture transmissions. The call trace event data can also comprise aradio bearer traffic report comprising a quality of service classidentifier used by the device to determine that the networkcommunication traffic comprises voice packets. The call trace event datacan comprise a time stamp indicative of a time at which the call traceevent data was recorded. The call trace event data can comprise aperiodically reported measurement (e.g., timing advance measurementrelated to a synchronization of signals transmitted between the userequipment and the network node device, RF measurements (e.g., RSRP,RSRQ). The call trace event data can comprise handover event datarelating to a handover of the wireless communication session from afirst mobile network cell of the wireless network to a second mobilenetwork cell of the wireless network. The call trace event data cancomprise a traffic downlink indicator. The call trace event data cancomprise a downlink duration indicator. The call trade event data canalso comprise a quality of service class identifier (QCI).

The operations 1000 can further comprise, at step 1020, sequencing andcombining the call trace event data for a period of the wirelesscommunication session (e.g., see FIG. 7, FIG. 8).

The operations 1000 can further comprise, at step 1030, analyzing thecall trace event data to determine a category (or, in other words,classification) of network communication traffic transmitted via acommunication channel between the network node device and the userequipment. The network communication traffic can be associated with anapplication executing on the user equipment (e.g., a live-streamingvideo application).

The operations 1000 can comprise, at step 1040, in response to adetermination that the network communication traffic comprises streamingvideo packets (e.g., live streaming video packets), initiating directingof network resources to be allocated to support the wirelesscommunication session. The TCF 505 can, for example send a message to anorchestration manager device (e.g., service orchestration manager 405),the message facilitating an allocation of the network resources. Thenetwork resources can be allocated using a software defined networkingprocess (e.g., SDN, as described above with respect to FIG. 2). Thenetwork resources can be associated with a network slice dedicated toperforming a defined network function (e.g., as shown in FIG. 4). Thenetwork resources, when allocated, result in an increase in an amount ofbandwidth used for the streaming video packets for the wirelesscommunication session. For example, the number of physical resourceblocks (PRBs) carrying video streaming packets in a time period, can beincreased.

Referring now to FIG. 11, example operations 1100, which can beperformed by a first network device (e.g., TCF 505), can comprise, atstep 1110, receiving, from a second network device (e.g., network node104) by a first network device comprising a processor, call trace eventdata relating to characteristics of a wireless communication sessionbetween the second network device and a user equipment (e.g., UE 102).The call trace event data (e.g., see FIG. 6) can comprise initialcontext setup data related to establishing the communication channel.The call trace event data can comprise context release data, and whereinthe context release data relates to a release of the communicationchannel for future transmissions. The call trace event data can comprisea radio bearer traffic report comprising a quality of service classidentifier used by the device to determine that the networkcommunication traffic comprises voice packets. The call trace event datacan comprise a time stamp indicative of a time at which the call traceevent data was recorded. The call trace event data can comprise aperiodically reported measurement (e.g., timing advance measurementrelated to a synchronization of signals transmitted between the userequipment and the network node device, RF measurements (e.g., RSRP,RSRQ). The call trace event data can comprise handover event datarelating to a handover of the wireless communication session from afirst mobile network cell of the wireless network to a second mobilenetwork cell of the wireless network. The call trace event data cancomprise a traffic downlink indicator. The call trace event data cancomprise a downlink duration indicator. The call trade event data canalso comprise a quality of service class identifier (QCI).

The operations 1100 can comprise, at step 1120, sequencing andcombining, by the first network device, the call trace event data for atime period applicable to the wireless communication session (e.g., seeFIG. 7, FIG. 8).

The operations 1100 can comprise, at step 1130, analyzing, by the firstnetwork device, the call trace event data to determine a category ofnetwork communication traffic transmitted via a communication channelbetween the second network device and the user equipment.

The operations 1100 can further comprise, at step 1140, in response to adetermination that the network communication traffic comprises streamingvideo packets, initiating, by the first network device, direction ofnetwork resources to be allocated to support the wireless communicationsession. The TCF 505 can, for example send a message to an orchestrationmanager device, the message facilitating an allocation of the networkresources. The network resources can be allocated using a softwaredefined networking process (e.g., SDN, as described above with respectto FIG. 2). The network resources can be associated with a network slicededicated to performing a defined network function (e.g., as shown inFIG. 4). The network resources, when allocated, result in an increase inan amount of bandwidth used for the streaming video packets for thewireless communication session. For example, the number of physicalresource blocks (PRBs) carrying video streaming packets in a timeperiod, can be increased.

Referring now to FIG. 12, example operations 1200, which can beperformed by a network device (e.g., TCF 505), can comprise, at step1210, receiving call trace event data from a network node device (e.g.,network node 104), wherein the call trace event data relates to acharacteristic of a wireless communication session between the networknode device and a user equipment (e.g., UE 102), wherein the wirelesscommunication session is associated with an application executing on theuser equipment. The call trace event data (e.g., see FIG. 6) cancomprise initial context setup data related to establishing thecommunication channel. The call trace event data can comprise contextrelease data, wherein the context release data relates to a release ofthe communication channel for subsequent communication sessions. Thecall trace event data can comprise a radio bearer traffic reportcomprising a quality of service class identifier used by the networkdevice to determine that the network communication traffic does notcomprise streaming video packets. The call trace event data can comprisea time stamp indicative of a time at which the call trace event data wasrecorded. The call trace event data can comprise a periodically reportedmeasurement (e.g., timing advance measurement related to asynchronization of signals transmitted between the user equipment andthe network node device, RF measurements (e.g., RSRP, RSRQ). The calltrace event data can comprise handover event data relating to a handoverof the wireless communication session from a first mobile network cellof the wireless network to a second mobile network cell of the wirelessnetwork. The call trace event data can comprise a traffic downlinkindicator. The call trace event data can comprise a downlink durationindicator. The call trade event data can also comprise a quality ofservice class identifier (QCI).

The operations 1200 can further comprise, at step 1220, sequencing andcombining the call trace event data during at least part of the wirelesscommunication session (e.g., see FIG. 7, FIG. 8).

The operations 1200 can further comprise, at step 1230, analyzing thecall trace event data to determine a category of network communicationtraffic transmitted via a communication channel between the network nodedevice and the user equipment.

The operations 1200 can further comprise, at step 1240, in response to adetermination that the network communication traffic comprises streamingvideo packets, instructing that network resources be allocated tosupport the wireless communication session. The TCF 505 can, for examplesend a message to an orchestration manager device, the messagefacilitating an allocation of the network resources. The networkresources can be allocated using a software defined networking process(e.g., SDN, as described above with respect to FIG. 2). The networkresources can be associated with a network slice dedicated to performinga defined network function (e.g., as shown in FIG. 4). The networkresources, when allocated, result in an increase in an amount ofbandwidth used for the streaming video packets for the wirelesscommunication session. For example, the number of physical resourceblocks (PRBs) carrying video streaming packets in a time period, can beincreased.

FIG. 13 illustrates a block diagram of a computer 1300 operable toexecute the functions and operations performed in the described exampleembodiments. For example, TCF 505 can contain components as described inFIG. 13. The computer 1300 can provide networking and communicationcapabilities between a wired or wireless communication network and aserver and/or communication device. In order to provide additionalcontext for various aspects thereof, FIG. 13 and the followingdiscussion are intended to provide a brief, general description of asuitable computing environment in which the various aspects of theembodiments can be implemented to facilitate the functions andoperations described herein. While the description above is in thegeneral context of computer-executable instructions that can run on oneor more computers, those skilled in the art will recognize that theembodiments also can be implemented in combination with other programmodules and/or as a combination of hardware and software.

Generally, program modules include routines, programs, components, datastructures, etc., that perform particular tasks or implement particularabstract data types. Moreover, those skilled in the art will appreciatethat the various methods can be practiced with other computer systemconfigurations, comprising single-processor or multiprocessor computersystems, minicomputers, mainframe computers, as well as personalcomputers, hand-held computing devices, microprocessor-based orprogrammable consumer electronics, and the like, each of which can beoperatively coupled to one or more associated devices.

The illustrated aspects of the embodiments can also be practiced indistributed computing environments where certain tasks are performed byremote processing devices that are linked through a communicationsnetwork. In a distributed computing environment, program modules can belocated in both local and remote memory storage devices.

Computing devices typically include a variety of media, which caninclude computer-readable storage media or communications media, whichtwo terms are used herein differently from one another as follows.

Computer-readable storage media can be any available storage media thatcan be accessed by the computer and comprises both volatile andnonvolatile media, removable and non-removable media. By way of example,and not limitation, computer-readable storage media can be implementedin connection with any method or technology for storage of informationsuch as computer-readable instructions, program modules, structureddata, or unstructured data. Computer-readable storage media can include,but are not limited to, RAM, ROM, EEPROM, flash memory or other memorytechnology, CD-ROM, digital versatile disk (DVD) or other optical diskstorage, magnetic cassettes, magnetic tape, magnetic disk storage orother magnetic storage devices, or other tangible and/or non-transitorymedia which can be used to store desired information. Computer-readablestorage media can be accessed by one or more local or remote computingdevices, e.g., via access requests, queries or other data retrievalprotocols, for a variety of operations with respect to the informationstored by the medium.

Communications media can embody computer-readable instructions, datastructures, program modules or other structured or unstructured data ina data signal such as a modulated data signal, e.g., a carrier wave orother transport mechanism, and comprises any information delivery ortransport media. The term “modulated data signal” or signals refers to asignal that has one or more of its characteristics set or changed insuch a manner as to encode information in one or more signals. By way ofexample, and not limitation, communication media include wired media,such as a wired network or direct-wired connection, and wireless mediasuch as acoustic, RF, infrared and other wireless media.

With reference to FIG. 13, implementing various aspects describedherein, devices can include a computer 1300, the computer 1300comprising a processing unit 1304, a system memory 1306 and a system bus1308. The system bus 1308 couples system components comprising thesystem memory 1306 to the processing unit 1304. The processing unit 1304can be any of various commercially available processors. Dualmicroprocessors and other multi-processor architectures can also beemployed as the processing unit 1304.

The system bus 1308 can be any of several types of bus structure thatcan further interconnect to a memory bus (with or without a memorycontroller), a peripheral bus, and a local bus using any of a variety ofcommercially available bus architectures. The system memory 1306comprises read-only memory (ROM) 1327 and random access memory (RAM)1312. A basic input/output system (BIOS) is stored in a non-volatilememory 1327 such as ROM, EPROM, EEPROM, which BIOS contains the basicroutines that help to transfer information between elements within thecomputer 1300, such as during start-up. The RAM 1312 can also include ahigh-speed RAM such as static RAM for caching data.

The computer 1300 further comprises an internal hard disk drive (HDD)1314 (e.g., EIDE, SATA), which internal hard disk drive 1314 can also beconfigured for external use in a suitable chassis (not shown), amagnetic floppy disk drive (FDD) 1316, (e.g., to read from or write to aremovable diskette 1318) and an optical disk drive 1320, (e.g., readinga CD-ROM disk 1322 or, to read from or write to other high capacityoptical media such as the DVD). The hard disk drive 1314, magnetic diskdrive 1316 and optical disk drive 1320 can be connected to the systembus 1308 by a hard disk drive interface 1324, a magnetic disk driveinterface 1326 and an optical drive interface 1328, respectively. Theinterface 1324 for external drive implementations comprises at least oneor both of Universal Serial Bus (USB) and IEEE 1294 interfacetechnologies. Other external drive connection technologies are withincontemplation of the subject embodiments.

The drives and their associated computer-readable media providenonvolatile storage of data, data structures, computer-executableinstructions, and so forth. For the computer 1300 the drives and mediaaccommodate the storage of any data in a suitable digital format.Although the description of computer-readable media above refers to aHDD, a removable magnetic diskette, and a removable optical media suchas a CD or DVD, it should be appreciated by those skilled in the artthat other types of media which are readable by a computer 1300, such aszip drives, magnetic cassettes, flash memory cards, cartridges, and thelike, can also be used in the example operating environment, andfurther, that any such media can contain computer-executableinstructions for performing the methods of the disclosed embodiments.

A number of program modules can be stored in the drives and RAM 1312,comprising an operating system 1330, one or more application programs1332, other program modules 1334 and program data 1336. All or portionsof the operating system, applications, modules, and/or data can also becached in the RAM 1312. It is to be appreciated that the embodiments canbe implemented with various commercially available operating systems orcombinations of operating systems.

A user can enter commands and information into the computer 1300 throughone or more wired/wireless input devices, e.g., a keyboard 1338 and apointing device, such as a mouse 1340. Other input devices (not shown)can include a microphone, an IR remote control, a joystick, a game pad,a stylus pen, touch screen, or the like. These and other input devicesare often connected to the processing unit 1304 through an input deviceinterface 1342 that is coupled to the system bus 1308, but can beconnected by other interfaces, such as a parallel port, an IEEE 2394serial port, a game port, a USB port, an IR interface, etc.

A monitor 1344 or other type of display device is also connected to thesystem bus 1308 through an interface, such as a video adapter 1346. Inaddition to the monitor 1344, a computer 1300 typically comprises otherperipheral output devices (not shown), such as speakers, printers, etc.

The computer 1300 can operate in a networked environment using logicalconnections by wired and/or wireless communications to one or moreremote computers, such as a remote computer(s) 1348. The remotecomputer(s) 1348 can be a workstation, a server computer, a router, apersonal computer, portable computer, microprocessor-based entertainmentdevice, a peer device or other common network node, and typicallycomprises many, if not all of, the elements described relative to thecomputer, although, for purposes of brevity, only a memory/storagedevice 1350 is illustrated. The logical connections depicted includewired/wireless connectivity to a local area network (LAN) 1352 and/orlarger networks, e.g., a wide area network (WAN) 1354. Such LAN and WANnetworking environments are commonplace in offices and companies, andfacilitate enterprise-wide computer networks, such as intranets, all ofwhich can connect to a global communications network, e.g., theInternet.

When used in a LAN networking environment, the computer 1300 isconnected to the local network 1352 through a wired and/or wirelesscommunication network interface or adapter 1356. The adapter 1356 canfacilitate wired or wireless communication to the LAN 1352, which canalso include a wireless access point disposed thereon for communicatingwith the wireless adapter 1356.

When used in a WAN networking environment, the computer 1300 can includea modem 1358, or is connected to a communications server on the WAN1354, or has other means for establishing communications over the WAN1354, such as by way of the Internet. The modem 1358, which can beinternal or external and a wired or wireless device, is connected to thesystem bus 1308 through the input device interface 1342. In a networkedenvironment, program modules depicted relative to the computer, orportions thereof, can be stored in the remote memory/storage device1350. It will be appreciated that the network connections shown areexemplary and other means of establishing a communications link betweenthe computers can be used.

The computer is operable to communicate with any wireless devices orentities operatively disposed in wireless communication, e.g., aprinter, scanner, desktop and/or portable computer, portable dataassistant, communications satellite, any piece of equipment or locationassociated with a wirelessly detectable tag (e.g., a kiosk, news stand,restroom), and telephone. This comprises at least Wi-Fi and Bluetooth™wireless technologies. Thus, the communication can be a predefinedstructure as with a conventional network or simply an ad hoccommunication between at least two devices.

Wi-Fi, or Wireless Fidelity, allows connection to the Internet from acouch at home, a bed in a hotel room, or a conference room at work,without wires. Wi-Fi is a wireless technology similar to that used in acell phone that enables such devices, e.g., computers, to send andreceive data indoors and out; anywhere within the range of a basestation. Wi-Fi networks use radio technologies called IEEE802.11 (a, b,g, n, etc.) to provide secure, reliable, fast wireless connectivity. AWi-Fi network can be used to connect computers to each other, to theInternet, and to wired networks (which use IEEE802.3 or Ethernet). Wi-Finetworks operate in the unlicensed 2.4 and 5 GHz radio bands, at an 11Mbps (802.11b) or 54 Mbps (802.11a) data rate, for example, or withproducts that contain both bands (dual band), so the networks canprovide real-world performance similar to the basic “10BaseT” wiredEthernet networks used in many offices.

As used in this application, the terms “system,” “component,”“interface,” and the like are generally intended to refer to acomputer-related entity or an entity related to an operational machinewith one or more specific functionalities. The entities disclosed hereincan be either hardware, a combination of hardware and software,software, or software in execution. For example, a component can be, butis not limited to being, a process running on a processor, a processor,an object, an executable, a thread of execution, a program, and/or acomputer. By way of illustration, both an application running on aserver and the server can be a component. One or more components canreside within a process and/or thread of execution and a component canbe localized on one computer and/or distributed between two or morecomputers. These components also can execute from various computerreadable storage media comprising various data structures storedthereon. The components can communicate via local and/or remoteprocesses such as in accordance with a signal comprising one or moredata packets (e.g., data from one component interacting with anothercomponent in a local system, distributed system, and/or across a networksuch as the Internet with other systems via the signal). As anotherexample, a component can be an apparatus with specific functionalityprovided by mechanical parts operated by electric or electroniccircuitry that is operated by software or firmware application(s)executed by a processor, wherein the processor can be internal orexternal to the apparatus and executes at least a part of the softwareor firmware application. As yet another example, a component can be anapparatus that provides specific functionality through electroniccomponents without mechanical parts, the electronic components cancomprise a processor therein to execute software or firmware thatconfers at least in part the functionality of the electronic components.An interface can comprise input/output (I/O) components as well asassociated processor, application, and/or API components.

Furthermore, the disclosed subject matter can be implemented as amethod, apparatus, or article of manufacture using standard programmingand/or engineering techniques to produce software, firmware, hardware,or any combination thereof to control a computer to implement thedisclosed subject matter. The term “article of manufacture” as usedherein is intended to encompass a computer program accessible from anycomputer-readable device, computer-readable carrier, orcomputer-readable media. For example, computer-readable media caninclude, but are not limited to, a magnetic storage device, e.g., harddisk; floppy disk; magnetic strip(s); an optical disk (e.g., compactdisk (CD), a digital video disc (DVD), a Blu-ray Disc™ (BD)); a smartcard; a flash memory device (e.g., card, stick, key drive); and/or avirtual device that emulates a storage device and/or any of the abovecomputer-readable media.

As it employed in the subject specification, the term “processor” canrefer to substantially any computing processing unit or devicecomprising single-core processors; single-processors with softwaremultithread execution capability; multi-core processors; multi-coreprocessors with software multithread execution capability; multi-coreprocessors with hardware multithread technology; parallel platforms; andparallel platforms with distributed shared memory. Additionally, aprocessor can refer to an integrated circuit, an application specificintegrated circuit (ASIC), a digital signal processor (DSP), a fieldprogrammable gate array (FPGA), a programmable logic controller (PLC), acomplex programmable logic device (CPLD), a discrete gate or transistorlogic, discrete hardware components, or any combination thereof designedto perform the functions described herein. Processors can exploitnano-scale architectures such as, but not limited to, molecular andquantum-dot based transistors, switches and gates, in order to optimizespace usage or enhance performance of UE. A processor also can beimplemented as a combination of computing processing units.

In the subject specification, terms such as “store,” “data store,” “datastorage,” “database,” “repository,” “queue”, and substantially any otherinformation storage component relevant to operation and functionality ofa component, refer to “memory components,” or entities embodied in a“memory” or components comprising the memory. It will be appreciatedthat the memory components described herein can be either volatilememory or nonvolatile memory, or can comprise both volatile andnonvolatile memory. In addition, memory components or memory elementscan be removable or stationary. Moreover, memory can be internal orexternal to a device or component, or removable or stationary. Memorycan comprise various types of media that are readable by a computer,such as hard-disc drives, zip drives, magnetic cassettes, flash memorycards or other types of memory cards, cartridges, or the like.

By way of illustration, and not limitation, nonvolatile memory cancomprise read only memory (ROM), programmable ROM (PROM), electricallyprogrammable ROM (EPROM), electrically erasable ROM (EEPROM), or flashmemory. Volatile memory can comprise random access memory (RAM), whichacts as external cache memory. By way of illustration and notlimitation, RAM is available in many forms such as synchronous RAM(SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rateSDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), anddirect Rambus RAM (DRRAM). Additionally, the disclosed memory componentsof systems or methods herein are intended to comprise, without beinglimited to comprising, these and any other suitable types of memory.

In particular and in regard to the various functions performed by theabove described components, devices, circuits, systems and the like, theterms (comprising a reference to a “means”) used to describe suchcomponents are intended to correspond, unless otherwise indicated, toany component which performs the specified function of the describedcomponent (e.g., a functional equivalent), even though not structurallyequivalent to the disclosed structure, which performs the function inthe herein illustrated example aspects of the embodiments. In thisregard, it will also be recognized that the embodiments comprises asystem as well as a computer-readable medium comprisingcomputer-executable instructions for performing the acts and/or eventsof the various methods.

Computing devices typically comprise a variety of media, which cancomprise computer-readable storage media and/or communications media,which two terms are used herein differently from one another as follows.Computer-readable storage media can be any available storage media thatcan be accessed by the computer and comprises both volatile andnonvolatile media, removable and non-removable media. By way of example,and not limitation, computer-readable storage media can be implementedin connection with any method or technology for storage of informationsuch as computer-readable instructions, program modules, structureddata, or unstructured data. Computer-readable storage media cancomprise, but are not limited to, RAM, ROM, EEPROM, flash memory orother memory technology, CD-ROM, digital versatile disk (DVD) or otheroptical disk storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or other tangible and/ornon-transitory media which can be used to store desired information.Computer-readable storage media can be accessed by one or more local orremote computing devices, e.g., via access requests, queries or otherdata retrieval protocols, for a variety of operations with respect tothe information stored by the medium.

On the other hand, communications media typically embodycomputer-readable instructions, data structures, program modules orother structured or unstructured data in a data signal such as amodulated data signal, e.g., a carrier wave or other transportmechanism, and comprises any information delivery or transport media.The term “modulated data signal” or signals refers to a signal that hasone or more of its characteristics set or changed in such a manner as toencode information in one or more signals. By way of example, and notlimitation, communications media comprise wired media, such as a wirednetwork or direct-wired connection, and wireless media such as acoustic,RF, infrared and other wireless media

Further, terms like “user equipment,” “user device,” “mobile device,”“mobile,” station,” “access terminal,” “terminal,” “handset,” andsimilar terminology, generally refer to a wireless device utilized by asubscriber or user of a wireless communication network or service toreceive or convey data, control, voice, video, sound, gaming, orsubstantially any data-stream or signaling-stream. The foregoing termsare utilized interchangeably in the subject specification and relateddrawings. Likewise, the terms “access point,” “node B,” “base station,”“evolved Node B,” “cell,” “cell site,” and the like, can be utilizedinterchangeably in the subject application, and refer to a wirelessnetwork component or appliance that serves and receives data, control,voice, video, sound, gaming, or substantially any data-stream orsignaling-stream from a set of subscriber stations. Data and signalingstreams can be packetized or frame-based flows. It is noted that in thesubject specification and drawings, context or explicit distinctionprovides differentiation with respect to access points or base stationsthat serve and receive data from a mobile device in an outdoorenvironment, and access points or base stations that operate in aconfined, primarily indoor environment overlaid in an outdoor coveragearea. Data and signaling streams can be packetized or frame-based flows.

Furthermore, the terms “user,” “subscriber,” “customer,” “consumer,” andthe like are employed interchangeably throughout the subjectspecification, unless context warrants particular distinction(s) amongthe terms. It should be appreciated that such terms can refer to humanentities, associated devices, or automated components supported throughartificial intelligence (e.g., a capacity to make inference based oncomplex mathematical formalisms) which can provide simulated vision,sound recognition and so forth. In addition, the terms “wirelessnetwork” and “network” are used interchangeable in the subjectapplication, when context wherein the term is utilized warrantsdistinction for clarity purposes such distinction is made explicit.

Moreover, the word “exemplary,” where used, is used herein to meanserving as an example, instance, or illustration. Any aspect or designdescribed herein as “exemplary” is not necessarily to be construed aspreferred or advantageous over other aspects or designs. Rather, use ofthe word exemplary is intended to present concepts in a concretefashion. As used in this application, the term “or” is intended to meanan inclusive “or” rather than an exclusive “or”. That is, unlessspecified otherwise, or clear from context, “X employs A or B” isintended to mean any of the natural inclusive permutations. That is, ifX employs A; X employs B; or X employs both A and B, then “X employs Aor B” is satisfied under any of the foregoing instances. In addition,the articles “a” and “an” as used in this application and the appendedclaims should generally be construed to mean “one or more” unlessspecified otherwise or clear from context to be directed to a singularform.

In addition, while a particular feature may have been disclosed withrespect to only one of several implementations, such feature can becombined with one or more other features of the other implementations asmay be desired and advantageous for any given or particular application.Furthermore, to the extent that the terms “have”, “having”, “includes”and “including” and variants thereof are used in either the detaileddescription or the claims, these terms are intended to be inclusive in amanner similar to the term “comprising.”

The above descriptions of various embodiments of the subject disclosureand corresponding figures and what is described in the Abstract, aredescribed herein for illustrative purposes, and are not intended to beexhaustive or to limit the disclosed embodiments to the precise formsdisclosed. It is to be understood that one of ordinary skill in the artcan recognize that other embodiments comprising modifications,permutations, combinations, and additions can be implemented forperforming the same, similar, alternative, or substitute functions ofthe disclosed subject matter, and are therefore considered within thescope of this disclosure. Therefore, the disclosed subject matter shouldnot be limited to any single embodiment described herein, but rathershould be construed in breadth and scope in accordance with the claimsbelow.

What is claimed is:
 1. A system, comprising: a processor; and a memorythat stores computer executable instructions that, when executed by theprocessor, facilitate performance of operations, comprising: during acommunication session comprising a wireless communication betweennetwork equipment and a user equipment, analyzing call trace event datafor the communication session to determine whether communication traffictransmitted via a communication channel between the network equipmentand the user equipment comprises streaming video packets, wherein thecall trace event data comprises information that indicates context setupand release, timing advance measurements, a first time length of adownlink communication, and a second time length of an uplinkcommunication, associated with the user equipment over a defined timeperiod during a portion of the communication session; during thecommunication session, as a result of the analyzing, determining whetherthe communication traffic comprises the streaming video packets based ona determination of an amount of time that has elapsed since a contextsetup associated with the user equipment without detection of a contextrelease associated with the user equipment in the call trace event data,a number of timing advance measurement reports received from the userequipment since the context setup without the detection of the contextrelease in the call trace event data, the first time length of thedownlink communication, and the second time length of the uplinkcommunication, over the defined time period during the portion of thecommunication session; and in response to determining that thecommunication traffic comprises the streaming video packets, directingthat network resources be allocated to support the communicationsession.
 2. The system of claim 1, wherein the operations furthercomprise: receiving, from the network equipment associated with acommunication network, the call trace event data for the communicationsession between the network equipment and the user equipment; andsequencing and combining the call trace event data during the portion ofthe communication session.
 3. The system of claim 1, wherein theoperations further comprise: during the communication session,predicting that the communication traffic comprises the streaming videopackets based on a result of the analyzing of the call trace event data.4. The system of claim 3, wherein, as part of the analyzing of the calltrace event data, a machine learning model utilizes a machine learningtechnique to analyze the call trace event data to facilitate predictinga classification of the communication traffic, and wherein thepredicting of the communication traffic comprises: during thecommunication session, predicting that the communication trafficcomprises the streaming video packets based on the result of theanalyzing of the call trace event data and an application of the machinelearning model to the call trace event data.
 5. The system of claim 1,wherein the operations further comprise: creating a network slice thatis utilized to perform a service relating to the streaming videopackets; and allocating the network resources to the network slice tofacilitate the supporting of the communication session.
 6. The system ofclaim 1, wherein the call trace event data comprises a radio bearertraffic report comprising the information that indicates a context setupassociated with the user equipment, a context release associated withthe user equipment, a timing advance measurement report associated withthe user equipment, a download volume and an upload volume of the userequipment over the defined time period during the portion of thecommunication session, the first time length of the downlinkcommunication and the second time length of the uplink communicationassociated with the user equipment over the defined time period, or aquality-of-service class identifier associated with the communicationtraffic.
 7. The system of claim 6, wherein the operations furthercomprise: based on the analyzing of the call trace event data,determining whether the communication traffic transmitted via thecommunication channel between the network equipment and the userequipment comprises the streaming video packets, voice packetsassociated with a voice phone call, data packets associated with anautonomous vehicle communication service, or sensor data packetsassociated with a sensor or a meter.
 8. The system of claim 1, whereinthe network resources comprise physical resource blocks, wherein, duringthe communication session, the physical resource blocks allocated to thesupport of the communication session are increased as compared to aprevious number of physical resource blocks allocated for thecommunication session, and wherein the increasing of the physicalresource blocks results in increasing an amount of bandwidth availablefor the streaming video packets for the communication session ascompared to a previous amount of bandwidth associated with the previousnumber of physical resource blocks.
 9. The system of claim 1, whereinthe call trace event data comprises initial context setup dataindicating a first time that the communication channel was establishedor context release data indicating a second time of a release of thecommunication channel for future transmissions.
 10. The system of claim1, wherein the call trace event data comprises handover event dataindicating a time of a handover of the communication session from afirst mobile network cell associated with a communication networkassociated with the network equipment to a second mobile network cellassociated with the communication network.
 11. A method, comprising:during a communication session comprising communication of a wirelesssignal between a base station and a device, analyzing, by a systemcomprising a processor, call trace event data to determine whethercommunication traffic transmitted via a communication channel betweenthe base station and the device comprises streaming video packets,wherein the call trace event data comprises information relating tocontext setup and release, timing advance measurements, a first timeduration of a downlink, and a second time duration of an uplink,associated with the device over a defined time period during a portionof the communication session; during the communication session,determining, by the system, whether the communication traffic comprisesthe streaming video packets based on a result of the analyzing, whereinthe result indicates a length of time that has elapsed since a contextsetup associated with the device without occurrence of a context releaseassociated with the device being identified in the call trace eventdata, a number of periodically reported measurements received from thedevice since the context setup without the occurrence of the contextrelease being identified in the call trace event data, the first timeduration of the downlink, and the second time duration of the uplink,over the defined time period during the portion of the communicationsession; and in response to determining, based on the analyzing, thatthe communication traffic comprises the streaming video packets,initiating, by the system, an allocation of network resources to supportthe communication session.
 12. The method of claim 11, furthercomprising: receiving, by the system, the call trace event data for thecommunication session between the base station and the device; andsequencing and combining, by the system, the call trace event dataduring the portion of the communication session.
 13. The method of claim11, wherein the initiating of the allocation of the network resourcescomprises communicating a message to an orchestration manager device,wherein, in response to the message, the orchestration manager devicefacilitates the allocation of the network resources.
 14. The method ofclaim 11, wherein the network resources are allocated using a softwaredefined networking process.
 15. The method of claim 11, furthercomprising: generating, by the system, a network slice that performs adefined network function, wherein the network resources are allocatedfrom a network slice dedicated to performing a defined network function;and allocating the network resources for use with the network slice tofacilitate the supporting of the communication session.
 16. The methodof claim 11, wherein, during the communication session, a first amountof the network resources allocated to the support of the communicationsession is higher than a second amount of network resources previouslyallocated for the communication session, and wherein the allocation ofthe first amount of the network resources to the support of thecommunication session results in an increase to a third amount ofbandwidth usable for the streaming video packets for the communicationsession as compared to a fourth amount of bandwidth associated with thesecond amount of network resources.
 17. The method of claim 11, whereinthe call trace event data comprises a time stamp indicative of a time atwhich a data item of the call trace event data was recorded.
 18. Themethod of claim 11, wherein the call trace event data comprises aperiodically reported measurement indicating a time that measurementsignals are transmitted between the device and the base station.
 19. Anon-transitory machine-readable medium comprising executableinstructions that, when executed by a processor, facilitate performanceof operations, comprising: during a wireless communication sessionbetween network equipment and a device, analyzing call trace event dataassociated with the wireless communication session to determine whethercommunication traffic transmitted via a communication channel betweenthe network equipment and the device comprises video streaming packets,wherein the call trace event data comprises context setup and releasedata, timing advance measurement data, and link data relating to a firstduration of a downlink and a second duration of an uplink, associatedwith the device over a defined time period during a portion of thewireless communication session; during the wireless communicationsession, determining whether the communication traffic comprises thevideo streaming packets based on a result of the analyzing, wherein theresult indicates an amount of time that has elapsed since a contextsetup associated with the device without detection of a context releaseassociated with the device in the call trace event data, a number oftiming advance measurement reports received from the device since thecontext setup without the detection of the context release in the calltrace event data, the first duration of the downlink, and the secondduration of the uplink, over the defined time period during the portionof the wireless communication session; and in response to determining,based on the analyzing, that the communication traffic comprises thestreaming video packets, instructing that network resources be allocatedto support the wireless communication session.
 20. The non-transitorymachine-readable medium of claim 19, wherein the operations furthercomprise: during the wireless communication session, receiving the calltrace event data associated with the wireless communication session,wherein the call trace event data is derived from the wirelesscommunication session between the network equipment and the device; andsequencing and combining the call trace event data during the portion ofthe wireless communication session.